#!/usr/bin/env bash
#
# Copyright (C) Hygon Info Technologies Ltd.
#
# SPDX-License-Identifier: Apache-2.0
#
set -x

. /opt/hygon/common.sh

set -o errexit
set -o errtrace
set -o pipefail

readonly script_name="$(basename "${BASH_SOURCE[0]}")"
readonly script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
readonly flannel_conf_url="https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml"
readonly pod_net_start=10.244.0
readonly pod_img_registry=registry.aliyuncs.com/google_containers

lib_file="${script_dir}/lib.sh"
source "$lib_file"

os_release=$(eval get_os_release)
init_k8s() {
    # Network is needed for k8s initial process.
    info "initialize K8S ..."
    kubeadm reset -f ||true
    case $os_release in
    "ubuntu")
        kubeadm init --cri-socket unix:///var/run/containerd/containerd.sock --pod-network-cidr=${pod_net_start}.0/16 --image-repository ${pod_img_registry} --kubernetes-version 1.27.0
    ;;
    "kylin" |"anolis")
        echo "1" >/proc/sys/net/ipv4/ip_forward
        kubeadm init --cri-socket unix:///var/run/containerd/containerd.sock --pod-network-cidr=${pod_net_start}.0/16 --image-repository ${pod_img_registry} --kubernetes-version 1.27.0
    ;;
    esac
    systemctl enable --now kubelet
}

# enable master node
enable_master_node() {
    info "enable master node ..."
    su -c \
    'export KUBECONFIG=/etc/kubernetes/admin.conf
    kubectl taint nodes --all node-role.kubernetes.io/control-plane-'
}

# install flannel
install_flannel() {
    info "install flannel ..."
    su -c \
        "export KUBECONFIG=/etc/kubernetes/admin.conf
        kubectl apply -f ../config/kube-flannel.yml"
}

update_kbs_uri() {
    kbs_ip="$(ip -o route get to 8.8.8.8 | sed -n 's/.*src \([0-9.]\+\).*/\1/p')"
    info "update kbs_uri to ${kbs_ip}"
    sed -i 's#^guest_pre_attestation_kbs_uri = .*#guest_pre_attestation_kbs_uri = "'$kbs_ip':44444"#' /opt/confidential-containers/share/defaults/kata-containers/configuration-qemu-csv.toml
    sed -i 's#^guest_pre_attestation_kbs_uri = .*#guest_pre_attestation_kbs_uri = "'$kbs_ip':44444"#' /opt/confidential-containers/share/defaults/kata-containers/configuration-qemu-csv-dcu.toml
}

# create kata RuntimeClass
create_kata_RuntimeClass() {
    info "create kata RuntimeClass ..."
    su -c \
"export KUBECONFIG=/etc/kubernetes/admin.conf
cat <<-EOF | kubectl apply -f -
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: kata
handler: kata
EOF

cat <<-EOF | kubectl apply -f -
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: kata-qemu
handler: kata-qemu
EOF

cat <<-EOF | kubectl apply -f -
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: kata-qemu-csv
handler: kata-qemu-csv
EOF

cat <<-EOF | kubectl apply -f -
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: kata-qemu-csv-dcu
handler: kata-qemu-csv-dcu
EOF"
}

import_export_certs() {
    info "import HGSC ..."
    /opt/hygon/bin/hag general hgsc_import
    info "export cert chain ..."
    mkdir -p /opt/csv
    /opt/hygon/bin/hag csv export_cert_chain
    cat pdh.cert pek.cert oca.cert cek.cert hsk.cert hrk.cert  > cert_chain.cert
    mv -f  cert_chain.cert /opt/csv/
}

run_simple_kbs() {
    info "run simple-kbs ..."
    pushd /opt/simple-kbs
    case $os_release in
    "ubuntu" | "anolis")
        docker compose down  -v --rmi all > /dev/null 2>&1 || true
        docker compose up -d
    ;;
    "kylin" )
        docker-compose down  -v --rmi all > /dev/null 2>&1 || true
        docker-compose up -d
    ;;
    esac
    popd
}

main() {
    check_root

    init_k8s
    enable_master_node
    install_flannel
    update_kbs_uri
    create_kata_RuntimeClass
    import_export_certs
    run_simple_kbs

    OK "Environment is set up, enjoy!"
}

main $*
